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ABSTRACT 

The driving requirement for design of a Mars Sample 
Return mission is to assure containment of the returned 
samples. Designing to, and demonstrating compliance 
with, such a requirement requires physics based tools 
that establish the relationship between engineer's sizing 
margins and probabilities of failure . The traditional 
method of determining margins on ablative thermal 
protection systems, while conservative, provides little 
insight into the actual probability of an over- 
temperature during flight. The objective of this paper is 
to describe a new methodology for establishing margins 
on sizing the thermal protection system (TPS). Results 
of this Monte Carlo approach are compared with 
traditional methods. 


INTRODUCTION 

The culmination of a Mars Sample Return (MSR) 
mission 1 * requires an Earth Entry Vehicle (EEV) that 
must safely transport Mars samples through Earth's 
atmosphere to a recoverable location on the surface. 
While there exists no evidence that these samples pose 
any threat to terrestrial biology, the samples will be 
handled as if they contain hazardous material. The EEV 
and the sample container(s) must, therefore, assure 
containment of the samples during this transit. In 
particular, it is anticipated that NASA's Planetary 
Protection Officer will levy a requirement on the MSR 
Mission that the probability of inadvertent release of 
Mars material into Earth's biosphere be less than a 
specified small value. 


The task of designing to, and demonstrating compliance 
with, such a requirement (in the absence of fleet-level 
heritage in entry systems) can be accomplished by 
coupling the vehicle's engineering design efforts with 
those of risk assessment early in the design process. 
Phenomenological analysis and tests used by engineers 
to size the design's components must be linked with 
logical risk models to incorporate quantitative risk data 
to guide design decisions. Unfortunately, designers and 
risk assessment experts seldom work within the same 
organizational structure, each possess their own 
oblique vocabulary, and often the risk assessment 
activities do not formally begin until completion of the 
detailed design. System trade studies conducted early in 
the development phase involve detailed quantification 
of performance parameters but little more than 
qualitative assessments of risk. Risk based design 
requires these two activities be concurrent and of 
balanced fidelity. 

One example of a hard link between risk assessment 
and quantitative engineering analysis would be a 
physics based tool which establishes the relationship 
between engineer’s safety margins and probabilities of 
failure. A collection of such tools covering the major 
risk elements of the design could then be integrated into 
the logical risk model for the vehicle and allow system 
level trades. 

The simplest approach to returning Mars samples safely 
through Earth’s atmosphere involves an entirely passive 
EEV 3 shown in Figure 1. This approach circumvents 
the failure modes of a parachute descent system by 
replacing that system with sufficient energy absorbing 
materials to “cushion" the samples during the ensuing 
ground impact. This approach removes most of the 
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failure modes associated with traditional entry capsules 
but still must demonstrate high reliability of its thermal 
protection system. 


Carbon-Carbon 

Structure 



A SIMPLIFIED FAULT TREE FOR 
FAILURE 


There exists numerous ways to decompose the potential 
causes of functional failure of a structural element of a 
vehicle. For the present work, it is convenient to 
represent a simplified form as follows. Failure of a 
vehicle’s element, for example failure of the heatshieid 
to limit temperatures in the underlying structures, could 
result if the environment it experiences during the 
mission (i.e. heating load) exceeds the expected values. 
Failure could also result from improper prediction of 
that element’s response to its expected environment. 
Finally, failure could be the result of the element’s 
physical properties were not as expected (i.e. 
manufacturing flaws or degradation in properties during 
previous mission phases). If any one of these errors, or 
a combination of errors from all three are sufficient to 
overcome the margin included in the design, the 
element fails to perform its function. 

THERMAL PROTECTION SYSTEM 


Figure 1. Schematic of entirely passive Earth Entry 
Vehicle. 

The objective of this paper is to describe a new 
methodology for establishing thickness margins on the 
thermal protection system (TPS) for entry vehicles. 

This methodology provides more insight into the 
relationship between thickness margin and probability 
of maintaining bondline temperatures within specified 
requirements than the traditional method of establishing 
TPS sizing margins. The approach is a Monte-Carlo 
analysis that links a three degree-of-freedom trajectory 
calculation and a distributed heating environment 
prediction including turbulence effects with a material 
response calculation. Simply stated, the Monte-Carlo 
analysis combines physics based tools that predict the 
environment with those used to predict the TPS 
material’s response to that environment. 

Results from the present approach with twelve 
statistically varying parameters are compared with 
those of the traditional approach for the MSR EEV 
case. Incorporation of the present methodology within 
the entire vehicle or mission Probabilistic Risk 
Assessment (PRA) is straightforward. In addition, this 
new methodology has application to any atmospheric 
entry vehicle design that seeks to establish a more 
rigorous relationship between TPS margins and 
probability of success. 


The function of an entry vehicle’s thermal protection 
system (TPS) is to protect underlying materials from 
the intense convective and radiative heating associated 
with hypersonic entry into the Earth’s atmosphere. TPS 
failure modes can be divided into two categories: 1) 
burn-through failure modes and 2) over-temperature 
failure modes. Bum-through failures are associated 
with catastrophic failure of the protective layer leading 
to direct exposure of the underlying structures to the 
flowfield. Over-temperature failures are associated with 
inadequate thermal insulation performance of the layer 
leading to TPS-structure bondline temperatures in 
excess of the specified limits. Determining the 
probability of a bum-through failure requires extensive 
testing in relevant environments of the material with all 
expected manufacturing variants. Additional thickness 
added to a TPS layer may do little to decrease the 
probability of a burn-through failure. Thickness margin 
is, however, effective in decreasing the probability of 
bondline over-temperature. The present method, which 
seeks to define the relationship between thickness 
margin and the probability of substructure over- 
temperature, addresses only the over-temperature 
failure mode. 

There are numerous challenges associated with 1) 
understanding the heatshield’s environment during 
entry, 2) understanding how the heatshieid will respond 
to that environment, and 3) understanding the possible 
variations in the TPS material properties. If 
quantitative data were collected for each of these 
uncertainties, there remains the challenge of combining 
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this information into a phenomenological model to 
determine the appropriate margins to apply when sizing 
the heatshield. 

Margins for ablative TPS systems have traditionally 
been determined in one of two ways: First, a stacked 
worst case approach in which all parameters are set to 
their worst case value and the required thickness margin 
computed; and second, a lumped uncertainties Root- 
Sum- Square approach. For the latter, the uncertainties 
in the environment are typically lumped together and a 
required thickness margin is computed assuming no 
uncertainties in the materials response to that 
environment. Next, the required thickness margin to 
cover uncertainty in the material's properties to the 
nominal environment is computed. The root-sum- 
square (RSS) of these two independent margins is then 
defined as the required thickness margin. Additional 
uncertainties in surface recession, manufacturing 
tolerance and another factor of safety may then be 
added on top of that RSS value to define the final TPS 
thickness. 

While the traditional method described above has 
proved to be a successful design practice, the 
interdependent nonlinearity of the problem does not 
permit a true quantification of the actual risk for this 
approach. Tn addition, changing the grouping of 
uncertainties in the RSS equation produces different 
results. Finally, for those approaches that add an 
additional safety factor and a manufacturing tolerance 
at the end of the process, there is no justification for 
safety factor values selected and no information on the 
effect of probability of failure from either addition. 
Results will be presented illustrating the correlation 
between heatshield safety margin and the probability 
that underlying materials are exposed to temperatures 
that exceed a specified maximum temperature failure 
criterion. 

UNCERTAINTIES IN THE 
ENVIRONMENT 

Uncertainties in the thermal environment encountered 
by a vehicle’s TPS during atmospheric entry are a 
combination of uncertainties associated with the flight 
trajectory of the vehicle and the prediction of the 
environment at each point in the trajectory. 

For a ballistic entry, the initial state at the edge of the 
atmosphere (i.e. initial velocity and initial entry angle), 
the vehicle’s ballistic coefficient, and the atmospheric 
properties determine the flight trajectory. Uncertainties 
in each of these parameters result in a dispersed set of 
possible trajectories. For a given time point in one of 


these trajectories, each spatial point on the vehicle will 
be subjected to a particular heating rate. The present 
Monte-Carlo analysis includes a three degree-of- 
ffeedom trajectory simulation with three statistically 
varying parameters. Variations in the initial velocity, 
initial flight path angle, and the vehicle's ballistic 
coefficient are considered. Variations in atmospheric 
properties were not included. 

The trajectory simulation includes a convective heating 
prediction from Chapman’s equation 3 4 and a radiative 
heating prediction from the Sutton-Graves correlation 5 . 
These predictions estimate the heating history at the 
vehicle's stagnation point. This heatpulse is shown in 
Figure 2 for the present nominal case. A high fidelity 
computational analysis is then computed at the peak 
heating conditions to establish a correction factor to the 
estimates mentioned above. The high fidelity solution 
also predicts the spatial distribution of heating at other 
points on the vehicle. The normalized laminar heating 
distribution at 1 1 points around the body is shown in 
Figure 3. By assuming this normalized distribution 
applies at all times during the heatpulse, a laminar 
heatpulse for each of the 1 1 points is generated. 



Figure 2. Nominal entry heating and Reynolds 
Number pulses. 


Thermochemical nonequilibrium computational 
analysis tools capable of predicting the laminar 
convective heating about an entry capsule at one of 
these trajectory points have reached a certain level of 
maturity. Uncertainties, however, still exist in those 
predictions. One of the statistically varying parameters 
is an uncertainty in this laminar prediction. A similar 
uncertainty is applied to the radiative heating 
prediction. 
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Shoulder 



Figure 3, Normalized heating distribution on the 
forebody at peak heating conditions. 


In addition, transition to turbulence and the 
augmentation of heating due to turbulence introduce 
uncertainties into predictions of the environment. For 
the EEV entry conditions, the primary mechanism of 
transition appears to be roughness. Roughness height 
Reynolds number is a similarity parameter that has been 
successful in predicting turbulence transition in this 
case for blunt vehicles. In the present analysis, 
computational solutions were generated at the peak 
heating point and the peak pressure point in the 
trajectory. Values for the roughness height Reynolds 
number can be extracted from these two solutions. 
However, this extraction requires a-priori knowledge of 
the surface roughness height. Surface roughness is 
intended to be an uncertainty in the present Monte- 
Carlo analysis. Therefore, roughness height Reynolds 
numbers were extracted at five different roughness 
heights for the two solutions generated. Examination of 
the data revealed that the relationship between this 
Reynolds number and the surface roughness was 
quadratic in surface roughness. Curve fits were 
generated to define this quadratic relationship at each of 
the 1 1 points for both of the solutions as shown in 
Figure 4. 

To handle the variation in roughness height Reynolds 
number with time, the two solutions available were 
utilized to establish a linear correlation with flight 
Reynolds number based on vehicle diameter. The flight 
Reynolds number for the nominal trajectory was input 
along with the heating values discussed earlier. 
Prediction for the roughness height Reynolds number at 
each of the 1 1 points on the forebody at each of the 
times during the trajectory is then accomplished by 1) 



Stagnation 

Point 


Figure 4. Variation in roughness height Reynolds 
number with roughness height for 1 1 points around 
the body at the maximum pressure trajectory point. 

defining the Reynolds number at each point on the body 
for peak heating and peak pressure for the current 
surface roughness, then 2) applying the linear flight 
Reynolds number adjustment to scale those values to 
each time during the entry. Each of these is then 
compared with the critical roughness height Reynolds 
number transition criteria (currently 250 with 3-sigma 
uncertainty of 60). If the value exceeds the criteria, 
local transition is assumed and the heating value is 
increased to account for augmentation to heating as a 
result of transition. Presently this augmentation factor is 
2.5 with 3-sigma uncertainty of 1.5. 

The result at this point in the simulation is a time 
varying heatpulse for each of the 1 1 points on the body 
that includes turbulence effects if the UWisition criteria 
is met. This heatpulse includes 3 statistically varying 
parameters associated with predicting the trajectory, 
two parameters associated with the laminar heating and 
three parameters associated with transition to 
turbulence. It remains to then examine the material's 
response to this environment at each point on the body 
to establish if the maximum bondline temperature 
failure criteria is exceeded. 

UNCERTAINTIES IN THE MATERIALS 
RESPONSE 


The present Monte-Carlo analysis contains the Charring 
Material Thermal Response and Ablation Program 
(CMA) 6 . CMA is a finite difference computational tool 
used to compute the 1-D transient thermal response of a 
3-D material that can ablate from the surface and 
decompose in-depth. Although the in-depth energy 
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balance is solved implicitly, it is linked explicitly to 
both the decomposition and the surface energy balance 
calculations. This explicit link is a minor limitation in 
the program. A prediction of the time history of the 
bondline temperature for the nominal heating case at 
the stagnation point is shown in Figure 5. 



Figure 5. Bondline temperature from the material 
response calculation on 1.095 cm carbon-phenolic 
heatshield. 

There are numerous uncertainties associated with this 
analysis. For the present Monte-Carlo analysis, 
uncertainties in the thermal conductivity and specific 
heat of both the virgin material and the char are 
included as statistically varying parameters. In addition, 
uncertainties in the virgin density are included for a 
total of five statistically varying parameters associated 
with the material response calculation. Due to the 
complex nature of the pyrolysis gas enthalpy and 
surface thermochemistry tables in CMA, variations in 
these parameters were not considered at this time. 

Computation of the 1-D ablation and thermal 
conduction results in a bondline temperature history at 
each of the 1 1 points for the case being examined. 
These histories are then compared against the bondline 
temperature constraint. If the bondline temperature at 
any point on the body at any time during the entry 
exceeds the failure criteria (currently 370°C), the case 
is counted as a failure. 

SUMMARY OF VARIABLES IN MONTE 
CARLO 

Table 1 summarizes the statistically varying inputs to 
the bondline overtemperature Monte-Carlo. The 
objective of this paper is to illustrate the present 


methodology, to that end, an attempt was made to select 
uncertainties that were reasonable, but these values are 
for illustration only. 

Note that an uncertainty about TPS thickness is 
included to embed manufacturing tolerances into the 
analysis. This framework could also allow uncertainties 
in the failure criteria as defined by the maximum 
allowable bondline temperature. This uncertainty was 
not considered in the results presented. 


Parameter 

Mean 

Value 

3a 

Uncertainty 

Initial Velocity 
(m/s) 

11553 

0.0 

Ballistic Coeff 
(kg/m 2 ) 

46.0 

5.0 

Flight Path Angle, 
(deg) 

-24.8 

0.9 

Radiative Heating 
Factor 

1.0 

18% 

Convective Heating 
Factor 

1.0 

18% 

Surface Roughness, 
(mm) 

0.4 

0.6* 

Critical Roughness Re 
Criteria 

250 

60 

Thermal Conductivity 
Factor, Virgin 

1.0 

15% 

Thermal Conductivity 
Factor, Char 

1.0 

15% 

Specific Heat Factor, 
Virgin 

1.0 

15% 

Specific Heat Factor, 
Char 

1.0 

15% 

Density Factor 

1.0 

15% 

TPS Thickness, (cm) 

1.0945 

0.12 


^negative values for surface roughness arc possible by this 
definition. To avoid this, surface roughness values were limited to 
non -negative values. 


Table 1. Summary of input parameters and 3-sigma 
uncertainties. 

Variations for the parameters are assumed to be normal 
distributions in the present example. This distribution 
may not be representative of data collected for a 
specific application. Distributions that best fit the 
available data should be employed 7 ' 8 . For example, 
manufacturing tolerances may be best represented by a 
uniform distribution. 
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RESULTS 


The present Monte-Carlo simulation includes a three 
degree-of-freedom trajectory calculation, a prediction 
of the distributed heating including turbulence effects, a 
CMA material response calculation, and manufacturing 
tolerances. The combined computational cost of the 
calculations is approximately 3 1 seconds per sample on 
an 850 MHz processor. Of those 3 1 seconds, 30 
seconds are spent in the CMA calculation. Since CMA 
uses an explicit numerical algorithm to solve the 
decomposition and surface energy balance equations, 
the time step is recomputed for each CMA calculation 
to optimize run time and minimize numerical 
instabilities. Consequently, variations in the 
computational time for each sample exist. 

A series of 2000-10000 sample Monte-Carlo 
simulations were performed to establish the relationship 
between the probability of exceeding the bondline 
temperature constraint and the thickness margin added. 
That relationship is shown in Figure 6. The figure 
reveals that 13.6% thickness margin is required to 
decrease the probability of bondline overtemperature to 
3 in 1000 for the assumed set of uncertainties. 



Figure 6. Relationship between probability of 
bondline over-temperature and thickness margin for 
the assumed uncertainties. 

Examination of the over-temperature failures during 
these runs indicates that all failures occurred at the 
stagnation point. This indicates that turbulence 
transition on the vehicle flank is not occurring 
sufficiently early during the heatpulse to increase 
heating on the flank points. Variation in the nominal 
roughness height Reynolds number criteria revealed 


Parameter 

Thickness Margin to cover 3 c 
Uncertainty 


Individual 

Contributions 

Lumped 

Contributions 

Initial 

Velocity 

0%^ 



Ballistic 

Coeff 

0.32% 



Flight Path 
Angle, 

1.87% 



Radiative 

Heating 

0.23% 


2.58% 

Convective 

Heating 

1.87% 



Surface Roughness 

0% 



Critical Roughness 
Re Criteria 

0%-^ 



Thermal 

Conductivity, 

Virgin 

"N 

3.70% 



Thermal 

Conductivity, 

Char 

4.71% 

> 

18.59% 

Specific Heat, 
Virgin 

2.79% 



Specific Heat, 
Char 

0.96% 



Density Factor 

5.25%^ 


i RSS 

8.9% 

18.8% 

TPS Thickness 

11.0% 

1 1 .0% 

RSS + TPS thick 

19.9% 

29.7% 

Stacked Worst Case 

33.8% 


Table 2. Independent and lumped contributions to 
thickness margin. 


that this critical value would have to be as low as 100 
(rather than the suggested value of 250) for turbulence 
transition to be important for this set of assumed inputs. 

The same analysis tools can be used to examine the 
relative impact of each of the statistically varying 
parameters. Table 2 presents each parameter and the 
required thickness margin necessary to cover the 3- 
sigma uncertainty in this parameter. 

Table 2 reveals that in this example, the single 
dominant contributor is the uncertainty in TPS 
manufacturing tolerances. In addition, the contributions 
from the material response parameters are much larger 
than the contributions from the environmental 
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parameters. These observations are dependent on the 
assumed uncertainties in these parameters and may not 
be representative for a given application. 

Table 2 also contains two results from traditional means 
of establishing margins. The stacked worse case 
prediction is 33.8% and a lumped uncertainty Root- 
Sum-Square approach with manufacturing tolerances 
added predicts 29.7%. Using Fig. 6, a comparison of 
these values with the 13.6% value for 3-sigma 
uncertainty (3 in 1000) reveals that the traditional 
means of computing margins results in much lower 
probabilities of over-temperature, approximately 1x10 8 
and 5xl0' 6 respectively. 


CONCLUSIONS 

The traditional methods of determining margins on 
ablative thermal protection systems, while conservative, 
provide little insight into the actual probability of an 
over-temperature during flight. Accurate quantification 
of this probability can be accomplished with the present 
method (if accurate input uncertainties are obtained). 
This quantification is accomplished by coupling 
physics-based analysis for the trajectory, the heating, 
and the material response into a single Monte-Carlo 
analysis. The present method includes turbulence 
transition and manufacturing tolerances. 

For the uncertainties of 12 input parameters used in 
this study, the Monte-Carlo analysis indicates that 
13.6% margin is required to decrease the probability of 
over-temperature to 3 in 1000. The traditional stacked 
worse case approach indicates the need for 33.8% 
thickness margin. An RSS between stacked worse case 
for the environment and for the material response 
uncertainties with a manufacturing tolerance added 
indicates 29.7%. These required thickness margins 
translate into probabilities of over-temperature well 
below the 3-sigma (3 in 1000) range. 

Risk based design requires accurate quantification of 
failure probabilities to provide insight towards trade 
studies and quantification of an over all risk model. The 
present Monte-Carlo method provides this accuracy. 

ACKNOWLEDGMENTS 

The authors would like to thank Joseph Fragola (SAIC) 
for many helpful discussions. Robert Dillman, Ruth 
Amundsen, Scott Hill, Lynn Craig, Dr. Y. K. Chen,. 
Bemie Laub and Ray Dirling also provided assistance 
in aspects of this work. 


REFERENCES 


‘Price, H, Cramer, K, Doudrick, S., Lee, W., Matijevic, 
J., Weinstein, S., Lam-Trong, T., Marsal, O., 
Mitcheltree, R.,"Mars Sample Return Spacecraft 
Systems Architecture,” IEEE Paper No., 1999. 

2 Hermann, R. J., and Lineberger, W. C. ,”Mars Sample 
Return: Issues and Recommendations,” Task Group on 
Issues in Sample Return, Space Studies Board, National 
Research Council, ISBN 0-309-057337, National 
Academy of Sciences, 1997. 

3 Mitcheltree, R., Braun, R., Simonsen, L., Hughes, 

S., "Earth Entry Vehicle for Mars Sample Return,” IAF 
paper No IAF-00-Q.3.04, October, 2000. 

dauber, M. E., and Sutton, K." Stagnation-Point 
Heating Relations for Earth and Mars Entries, ’’Journal 
of Spacecraft and Rockets, Vol. 28, No. 1, 1991, pp 40- 
42. 

5 Sutton, K., Graves, R. A.," A General Stagnation Point 
Convective Heating Equation for Arbitrary Gas 
Mixtures,” NASA TR-R-376, Nov., 1971. 

^'User's Manual, Aerotherm Charring Material Thermal 
Response and Ablation Program", Acurex Corporation, 
Aerotherm Division, Mountain View, California, 
November, 1987. 

7 Fox, E. P., Safie, F., "A Probabilistic Design Analysis 
Approach for Launch Systems,” AIAA Paper 91-3372, 
June, 1991. 

8 Fox, E. P., Safie, F. "Statistical Characterization of 
Life Drivers for a Probabilistic Design Analysis,” 

AIAA Paper 92-3414, July, 1992. 


7 

American Institute of Aeronautics and Astronautics 




